Repository navigation
ci: gate releases on exact candidate runtime advisories - #608
Conversation
|
Merge authorized by the maintainer’s explicit instruction. Reviewed isolated runtime/scanner environments, unpublished-candidate exclusion only, strict report classification, unchanged Azure/coverage/security gates. Exact head 4e860da: all five required contexts completed=success; no unresolved threads. Local make check-all build: 788 passed, 27 deselected, 4 warnings in 18.96s; runtime audit eight dependencies with zero advisories. Release matrix itself requires a release trigger and was not dispatched; no cloud commands run. |
There was a problem hiding this comment.
🟡 Changes recommended
The guard-test environment blocks clean releases, and malformed audit reports can incorrectly pass the release gate.
2 open issues
What changed in this PR
Adds an exact-candidate runtime advisory gate to the release pipeline and security-boundary regression tests, addressing the remaining work in #567 without changing runtime APIs.
Changes:
- Audits the candidate wheel’s resolved dependencies on Python 3.11–3.14 and requires the audit before publishing.
- Separates scanner tooling from runtime dependencies and retains audit evidence.
- Adds response-sanitization and route-authentication proofs, with security documentation.
| File | Description |
|---|---|
tests/test_security_boundary_proofs.py |
Tests response sanitization and preservation of route authentication. |
tests/test_runtime_audit_report.py |
Tests audit outcomes and report-error handling. |
tests/test_runtime_audit_contract.py |
Checks release-gate wiring and interpreter coverage. |
SECURITY.md |
Documents the advisory gate and security boundaries. |
scripts/check_runtime_audit.py |
Classifies audit reports and scanner failures. |
scripts/audit_candidate.sh |
Installs and audits the candidate in isolated environments. |
Makefile |
Adds the audit-candidate entry point. |
.github/workflows/publish-pypi.yml |
Adds the required audit matrix and evidence uploads. |
Review effort: Balanced
| - name: Verify audit guards on the selected interpreter | ||
| run: | | ||
| pip install pytest pytest-cov | ||
| python -m pytest -o addopts= tests/test_runtime_audit_report.py |
| if not dependencies or any("skip_reason" in item for item in dependencies): | ||
| raise ValueError("incomplete runtime inventory") | ||
| findings = any(item["vulns"] for item in dependencies) |
Summary
Complete the remaining release advisory and trust-boundary evidence from #567. Existing main already bounds hostile JSON depth/integers, expands fail-closed Bandit and runs supported Semgrep.
Changes
Install the candidate wheel in a fresh runtime environment and audit its resolved frozen closure with a separate pinned scanner environment. Publishing requires this gate on Python 3.11–3.14. Known advisories exit 1; incomplete/malformed reports and tool failures exit 2; both block. Upload inventory and scanner JSON even after failures. Add sync/async SDK/helper response-sanitization, failing-formatter and route-auth preservation proofs. No advisory exception framework or runtime API change.
Validation
Related Issues
Closes #567
Merge authorized by the maintainer’s explicit instruction.